Flock vulnerability false positive (#13827)

server/vulnerabilities/nvd/README.md

@@ -0,0 +1,27 @@
+# Testing CPE Translations
+
+To improve accuracy when [mapping software to CVEs](../../../docs/Using%20Fleet/Vulnerability-Processing.md), we can add data to [cpe_translations.json](./cpe_translations.json) which
+will get picked up by the NVD repo.
+
+To test these changes locally, you can:
+
+1. make the [appropriate](../../../docs/Using%20Fleet/Vulnerability-Processing.md#Improving-accuracy) changes to cpe_translations
+
+2. host this file on a local web server
+
+    ```bash
+    ./tools/file-server 8082 ./server/vulnerabilities/nvd/cpe_translations.json
+    ```
+
+3. (re)launch your local fleet server with the following `--config`
+
+    ```yaml
+    vulnerabilities:
+    cpe_translations_url: "http://localhost:8082/cpe_translations.json"
+    ```
+
+4. trigger the vulnerabilities scan
+
+    ```bash
+    fleetctl trigger --name vulnerabilities
+    ```

server/vulnerabilities/nvd/cpe_translations.go

@@ -108,10 +108,10 @@ func (r *regexpCache) Get(pattern string) (*regexp.Regexp, error) {
 //
 //	[
 //	  {
-//	    "match": {
+//	    "software": {
 //	      "bundle_identifier": ["com.1password.1password"]
 //	    },
-//	    "translation": {
+//	    "filter": {
 //	      "product": ["1password"],
 //	      "vendor": ["agilebits"]
 //	    }

server/vulnerabilities/nvd/cpe_translations.json

@@ -100,5 +100,24 @@
     "filter": {
       "skip": true
     }
+  },
+  {
+    "software": {
+      "name": ["flock"],
+      "source": ["homebrew_packages"]
+    },
+    "filter": {
+      "skip": true
+    }
+  },
+  {
+    "software": {
+      "name": ["Flock.app"],
+      "source": ["apps"]
+    },
+    "filter": {
+      "product": ["flock"],
+      "vendor": ["flock"]
+    }
   }
 ]

server/vulnerabilities/nvd/sync.go

@@ -5,7 +5,6 @@ import (
 	"encoding/csv"
 	"encoding/json"
 	"fmt"
-	"github.com/fleetdm/fleet/v4/server/contexts/license"
 	"io"
 	"net/url"
 	"os"
@@ -14,6 +13,8 @@ import (
 	"strings"
 	"time"
 
+	"github.com/fleetdm/fleet/v4/server/contexts/license"
+
 	"github.com/facebookincubator/nvdtools/cvefeed"
 	feednvd "github.com/facebookincubator/nvdtools/cvefeed/nvd"
 	"github.com/fleetdm/fleet/v4/pkg/download"
@@ -32,11 +33,12 @@ type SyncOptions struct {
 }
 
 // Sync downloads all the vulnerability data sources.
-func Sync(opts SyncOptions) error {
+func Sync(opts SyncOptions, logger log.Logger) error {
 	if err := DownloadCPEDBFromGithub(opts.VulnPath, opts.CPEDBURL); err != nil {
 		return fmt.Errorf("sync CPE database: %w", err)
 	}
 
+	level.Debug(logger).Log("msg", "downloading CPE translations", "url", opts.CPETranslationsURL)
 	if err := DownloadCPETranslationsFromGithub(opts.VulnPath, opts.CPETranslationsURL); err != nil {
 		return fmt.Errorf("sync CPE translations: %w", err)
 	}